Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1632-1 Final 1 1 2021-12-28T07:45:13Z current 2021-12-28T07:45:13Z 2021-12-28T07:45:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium 96.0.4664.110 (boo#1193713): * CVE-2021-4098: Insufficient data validation in Mojo * CVE-2021-4099: Use after free in Swiftshader * CVE-2021-4100: Object lifecycle issue in ANGLE * CVE-2021-4101: Heap buffer overflow in Swiftshader * CVE-2021-4102: Use after free in V8 Lord of the Browsers: The Two Compilers: * Go back to GCC * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ Chromium 96.0.4664.93 (boo#1193519): * CVE-2021-4052: Use after free in web apps * CVE-2021-4053: Use after free in UI * CVE-2021-4079: Out of bounds write in WebRTC * CVE-2021-4054: Incorrect security UI in autofill * CVE-2021-4078: Type confusion in V8 * CVE-2021-4055: Heap buffer overflow in extensions * CVE-2021-4056: Type Confusion in loader * CVE-2021-4057: Use after free in file API * CVE-2021-4058: Heap buffer overflow in ANGLE * CVE-2021-4059: Insufficient data validation in loader * CVE-2021-4061: Type Confusion in V8 * CVE-2021-4062: Heap buffer overflow in BFCache * CVE-2021-4063: Use after free in developer tools * CVE-2021-4064: Use after free in screen capture * CVE-2021-4065: Use after free in autofill * CVE-2021-4066: Integer underflow in ANGLE * CVE-2021-4067: Use after free in window manager * CVE-2021-4068: Insufficient validation of untrusted input in new tab page Chromium 96.0.4664.45 (boo#1192734): * CVE-2021-38007: Type Confusion in V8 * CVE-2021-38008: Use after free in media * CVE-2021-38009: Inappropriate implementation in cache * CVE-2021-38006: Use after free in storage foundation * CVE-2021-38005: Use after free in loader * CVE-2021-38010: Inappropriate implementation in service workers * CVE-2021-38011: Use after free in storage foundation * CVE-2021-38012: Type Confusion in V8 * CVE-2021-38013: Heap buffer overflow in fingerprint recognition * CVE-2021-38014: Out of bounds write in Swiftshader * CVE-2021-38015: Inappropriate implementation in input * CVE-2021-38016: Insufficient policy enforcement in background fetch * CVE-2021-38017: Insufficient policy enforcement in iframe sandbox * CVE-2021-38018: Inappropriate implementation in navigation * CVE-2021-38019: Insufficient policy enforcement in CORS * CVE-2021-38020: Insufficient policy enforcement in contacts picker * CVE-2021-38021: Inappropriate implementation in referrer * CVE-2021-38022: Inappropriate implementation in WebAuthentication The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-1632 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ E-Mail link for openSUSE-SU-2021:1632-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1192310 SUSE Bug 1192310 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 https://bugzilla.suse.com/1193713 SUSE Bug 1193713 https://www.suse.com/security/cve/CVE-2021-38005/ SUSE CVE CVE-2021-38005 page https://www.suse.com/security/cve/CVE-2021-38006/ SUSE CVE CVE-2021-38006 page https://www.suse.com/security/cve/CVE-2021-38007/ SUSE CVE CVE-2021-38007 page https://www.suse.com/security/cve/CVE-2021-38008/ SUSE CVE CVE-2021-38008 page https://www.suse.com/security/cve/CVE-2021-38009/ SUSE CVE CVE-2021-38009 page https://www.suse.com/security/cve/CVE-2021-38010/ SUSE CVE CVE-2021-38010 page https://www.suse.com/security/cve/CVE-2021-38011/ SUSE CVE CVE-2021-38011 page https://www.suse.com/security/cve/CVE-2021-38012/ SUSE CVE CVE-2021-38012 page https://www.suse.com/security/cve/CVE-2021-38013/ SUSE CVE CVE-2021-38013 page https://www.suse.com/security/cve/CVE-2021-38014/ SUSE CVE CVE-2021-38014 page https://www.suse.com/security/cve/CVE-2021-38015/ SUSE CVE CVE-2021-38015 page https://www.suse.com/security/cve/CVE-2021-38016/ SUSE CVE CVE-2021-38016 page https://www.suse.com/security/cve/CVE-2021-38017/ SUSE CVE CVE-2021-38017 page https://www.suse.com/security/cve/CVE-2021-38018/ SUSE CVE CVE-2021-38018 page https://www.suse.com/security/cve/CVE-2021-38019/ SUSE CVE CVE-2021-38019 page https://www.suse.com/security/cve/CVE-2021-38020/ SUSE CVE CVE-2021-38020 page https://www.suse.com/security/cve/CVE-2021-38021/ SUSE CVE CVE-2021-38021 page https://www.suse.com/security/cve/CVE-2021-38022/ SUSE CVE CVE-2021-38022 page https://www.suse.com/security/cve/CVE-2021-4052/ SUSE CVE CVE-2021-4052 page https://www.suse.com/security/cve/CVE-2021-4053/ SUSE CVE CVE-2021-4053 page https://www.suse.com/security/cve/CVE-2021-4054/ SUSE CVE CVE-2021-4054 page https://www.suse.com/security/cve/CVE-2021-4055/ SUSE CVE CVE-2021-4055 page https://www.suse.com/security/cve/CVE-2021-4056/ SUSE CVE CVE-2021-4056 page https://www.suse.com/security/cve/CVE-2021-4057/ SUSE CVE CVE-2021-4057 page https://www.suse.com/security/cve/CVE-2021-4058/ SUSE CVE CVE-2021-4058 page https://www.suse.com/security/cve/CVE-2021-4059/ SUSE CVE CVE-2021-4059 page https://www.suse.com/security/cve/CVE-2021-4061/ SUSE CVE CVE-2021-4061 page https://www.suse.com/security/cve/CVE-2021-4062/ SUSE CVE CVE-2021-4062 page https://www.suse.com/security/cve/CVE-2021-4063/ SUSE CVE CVE-2021-4063 page https://www.suse.com/security/cve/CVE-2021-4064/ SUSE CVE CVE-2021-4064 page https://www.suse.com/security/cve/CVE-2021-4065/ SUSE CVE CVE-2021-4065 page https://www.suse.com/security/cve/CVE-2021-4066/ SUSE CVE CVE-2021-4066 page https://www.suse.com/security/cve/CVE-2021-4067/ SUSE CVE CVE-2021-4067 page https://www.suse.com/security/cve/CVE-2021-4068/ SUSE CVE CVE-2021-4068 page https://www.suse.com/security/cve/CVE-2021-4078/ SUSE CVE CVE-2021-4078 page https://www.suse.com/security/cve/CVE-2021-4079/ SUSE CVE CVE-2021-4079 page https://www.suse.com/security/cve/CVE-2021-4098/ SUSE CVE CVE-2021-4098 page https://www.suse.com/security/cve/CVE-2021-4099/ SUSE CVE CVE-2021-4099 page https://www.suse.com/security/cve/CVE-2021-4100/ SUSE CVE CVE-2021-4100 page https://www.suse.com/security/cve/CVE-2021-4101/ SUSE CVE CVE-2021-4101 page https://www.suse.com/security/cve/CVE-2021-4102/ SUSE CVE CVE-2021-4102 page openSUSE Leap 15.2 chromedriver-96.0.4664.110-lp152.2.143.1 chromium-96.0.4664.110-lp152.2.143.1 chromedriver-96.0.4664.110-lp152.2.143.1 as a component of openSUSE Leap 15.2 chromium-96.0.4664.110-lp152.2.143.1 as a component of openSUSE Leap 15.2 Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38005 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38005.html CVE-2021-38005 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38006 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38006.html CVE-2021-38006 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38007 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38007.html CVE-2021-38007 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38008 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38008.html CVE-2021-38008 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2021-38009 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38009.html CVE-2021-38009 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. CVE-2021-38010 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38010.html CVE-2021-38010 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38011 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38011.html CVE-2021-38011 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38012 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38012.html CVE-2021-38012 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-38013 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38013.html CVE-2021-38013 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38014 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38014.html CVE-2021-38014 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. CVE-2021-38015 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38015.html CVE-2021-38015 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page. CVE-2021-38016 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38016.html CVE-2021-38016 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. CVE-2021-38017 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38017.html CVE-2021-38017 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page. CVE-2021-38018 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38018.html CVE-2021-38018 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2021-38019 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38019.html CVE-2021-38019 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. CVE-2021-38020 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38020.html CVE-2021-38020 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. CVE-2021-38021 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38021.html CVE-2021-38021 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2021-38022 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 critical 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-38022.html CVE-2021-38022 https://bugzilla.suse.com/1192734 SUSE Bug 1192734 Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. CVE-2021-4052 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4052.html CVE-2021-4052 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4053 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4053.html CVE-2021-4053 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. CVE-2021-4054 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4054.html CVE-2021-4054 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. CVE-2021-4055 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4055.html CVE-2021-4055 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4056 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4056.html CVE-2021-4056 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4057 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4057.html CVE-2021-4057 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4058 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4058.html CVE-2021-4058 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2021-4059 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4059.html CVE-2021-4059 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4061 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4061.html CVE-2021-4061 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4062 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4062.html CVE-2021-4062 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4063 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4063.html CVE-2021-4063 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4064 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4064.html CVE-2021-4064 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4065 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4065.html CVE-2021-4065 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4066 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4066.html CVE-2021-4066 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4067 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4067.html CVE-2021-4067 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2021-4068 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4068.html CVE-2021-4068 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4078 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4078.html CVE-2021-4078 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crafted WebRTC packets. CVE-2021-4079 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4079.html CVE-2021-4079 https://bugzilla.suse.com/1193519 SUSE Bug 1193519 Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-4098 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4098.html CVE-2021-4098 https://bugzilla.suse.com/1193713 SUSE Bug 1193713 Use after free in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4099 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4099.html CVE-2021-4099 https://bugzilla.suse.com/1193713 SUSE Bug 1193713 Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4100 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4100.html CVE-2021-4100 https://bugzilla.suse.com/1193713 SUSE Bug 1193713 Heap buffer overflow in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4101 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4101.html CVE-2021-4101 https://bugzilla.suse.com/1193713 SUSE Bug 1193713 Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-4102 openSUSE Leap 15.2:chromedriver-96.0.4664.110-lp152.2.143.1 openSUSE Leap 15.2:chromium-96.0.4664.110-lp152.2.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJZLITO4GTLR5FP75FBCLDYZMUY2AFI/ https://www.suse.com/security/cve/CVE-2021-4102.html CVE-2021-4102 https://bugzilla.suse.com/1193713 SUSE Bug 1193713